PRI-03: Data Privacy Accountability Structure
Mechanisms exist to establish a data privacy accountability structure that: (1) Identifies data privacy roles required by applicable statutory, regulatory and/or contractual obligations; (2) Assigns each role to one or more individuals with the requisite qualifications, authority, independence and resources; and (3) Is reviewed and updated as data privacy obligations, operating jurisdictions and/or business practices change.
Code reused: In SCF 2025.4 and earlier, PRI-03 was Choice & Consent. That control is now PRI-24.
Control Question: Does the organization establish a data privacy accountability structure that: (1) Identifies data privacy roles required by applicable statutory, regulatory and/or contractual obligations; (2) Assigns each role to one or more individuals with the requisite qualifications, authority, independence and resources; and (3) Is reviewed and updated as data privacy obligations, operating jurisdictions and/or business practices change?
General (13)
| Framework | Mapping Values |
|---|---|
| AICPA Privacy Management Framework (PMF) | M1.2-POF2 M1.2-POF4 |
| NIST 800-37 R2 | TASK P-1 |
| NIST 800-53 R5.2 | PM-18 |
| NIST 800-53B R5 (privacy) (source) | PM-18 |
| NIST 800-82 R3 | PM-18 |
| NIST 800-82 R3 LOW OT Overlay | PM-18 |
| NIST 800-82 R3 MODERATE OT Overlay | PM-18 |
| NIST 800-82 R3 HIGH OT Overlay | PM-18 |
| NIST 800-161 R1 | PM-18 |
| NIST 800-161 R1 Flow Down | PM-18 |
| NIST 800-161 R1 Level 1 | PM-18 |
| NIST 800-161 R1 Level 2 | PM-18 |
| SCF DPMP 2026 | 1.1 |
US (1)
| Framework | Mapping Values |
|---|---|
| USA Federal IRS 1075 2021 | 2.C.2-18 |
APAC (1)
| Framework | Mapping Values |
|---|---|
| APAC South Korea PIPA 2011 | IV.31(6) |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
Privacy (PRI) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with PRI domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Data privacy-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ No formal data privacy team exists. Privacy roles are assigned to existing IT / cybersecurity.
Level 2 — Planned & Tracked
Privacy (PRI) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Data privacy management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Data privacy management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 — Well Defined
Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners. ▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 — Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- PRI-03_A01 a documented data privacy accountability structure exists.
- PRI-03_A02 the data privacy accountability structure identifies the data privacy roles required by applicable statutory, regulatory and/or contractual obligations (e.g., Data Protection Officer (DPO), representative in a jurisdiction, data owner).
- PRI-03_A03 each identified data privacy role is assigned to one or more named individuals.
- PRI-03_A04 individuals assigned to data privacy roles possess the requisite qualifications for the role.
- PRI-03_A05 individuals assigned to data privacy roles are granted the authority, independence and resources needed to perform the role.
- PRI-03_A06 the data privacy accountability structure is reviewed and updated when data privacy obligations, operating jurisdictions and/or business practices change.
Evidence Requirements
- E-HRS-04 Assigned Roles - Data Privacy Staff
-
List of employed or contract personnel assigned to data privacy roles.
Human Resources - E-HRS-08 Role Assignment - CPO
-
Documented evidence of a formal role assignment to the Chief Privacy Officer (CPO) position.
Human Resources - E-HRS-10 Role Assignment - DPO
-
Documented evidence of a formal role assignment to Data Protection Officer (DPO) positions.
Human Resources
Technology Recommendations
Micro/Small
- Designated privacy point of contact (may be the owner or office manager)
- Documented privacy responsibilities
Small
- Assigned privacy lead with documented responsibilities
- External DPO or privacy counsel where legally required
Medium
- Data privacy program with assigned Chief Privacy Officer (CPO) or equivalent
- Data Protection Officer (DPO) where required
- Privacy roles documented in a RACI
Large
- Formal privacy office with CPO and DPO(s) by jurisdiction
- Privacy management platform (e.g., OneTrust, TrustArc)
- Annual review of privacy roles against obligations
Enterprise
- Enterprise privacy governance structure with CPO, regional DPOs and privacy champions
- Privacy management platform (e.g., OneTrust, TrustArc, Securiti)
- Board-level privacy reporting
- Annual accountability structure review